hatchkit 0.2.1 → 0.2.3

package/dist/index.js

@@ -1,19 +1,20 @@
 #!/usr/bin/env node
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { confirm } from "@inquirer/prompts";
 import chalk from "chalk";
-import { ensureCoolify, ensureGitHub, ensureHetzner, ensureS3, getConfig, getConfigPath, getCoolifyConfig, getGhcrConfig, getMlServices, isFirstRun, reconfigureProvider, resetConfig, runOnboarding, } from "./config.js";
+import { ensureCoolify, ensureDns, ensureGitHub, ensureHetzner, ensureS3, getConfig, getConfigPath, getCoolifyConfig, getGhcrConfig, getMlServices, isFirstRun, reconfigureProvider, resetConfig, runOnboarding, } from "./config.js";
 import { runCoolifySetup } from "./deploy/coolify.js";
 import { setupGitHub } from "./deploy/github.js";
 import { deployMlServices } from "./deploy/gpu.js";
 import { pushProjectKeyToCoolify, pushProjectKeyToGh, rotateProjectKey, setProjectKey, showProjectKey, } from "./deploy/keys.js";
 import { handleCreateFailure, runRollback } from "./deploy/rollback.js";
-import { runTerraform } from "./deploy/terraform.js";
+import { requireCloudflareZoneForTerraform, runTerraform } from "./deploy/terraform.js";
 import { collectProjectConfig } from "./prompts.js";
-import { runProvision, runUnprovision } from "./provision/index.js";
+import { runProvision, runUnprovision, } from "./provision/index.js";
 import { scaffoldApp } from "./scaffold/app.js";
 import { scaffoldInfra } from "./scaffold/infra.js";
+import { readManifest } from "./scaffold/manifest.js";
 import { mlEnvVarName, printMlSummary, resolveMlServices } from "./scaffold/ml-client.js";
 import { runUpdate } from "./scaffold/update.js";
 import { installCancelHandler, isCancelInProgress, uninstallCancelHandler, } from "./utils/cancel-handler.js";
@@ -438,10 +439,10 @@ function opts(result) {
  *  dir already lives inside the project (`packages/server`,
  *  `apps/web`, etc.). Returns undefined when no manifest is found —
  *  callers fall back to "skip s3" with a hint. */
-function inferProjectDir(serverEnvDir) {
-    if (!serverEnvDir)
+function inferProjectDir(startDir) {
+    if (!startDir)
         return undefined;
-    let cur = serverEnvDir;
+    let cur = startDir;
     for (let i = 0; i < 4; i++) {
         if (existsSync(join(cur, ".hatchkit.json")))
             return cur;
@@ -452,15 +453,165 @@ function inferProjectDir(serverEnvDir) {
     }
     return undefined;
 }
+function manifestBucketEntries(manifest) {
+    const buckets = manifest?.s3Buckets;
+    if (!buckets)
+        return [];
+    const out = [];
+    for (const [key, value] of Object.entries(buckets)) {
+        if (key === "tokenId" || key === "accountId")
+            continue;
+        if (value && typeof value === "object" && "name" in value) {
+            out.push(value);
+        }
+    }
+    return out;
+}
+function readIfExists(path) {
+    if (!existsSync(path))
+        return "";
+    try {
+        return readFileSync(path, "utf-8");
+    }
+    catch {
+        return "";
+    }
+}
+function readProjectEnvText(projectDir, baseName) {
+    const chunks = [];
+    if (projectDir) {
+        for (const dir of [
+            ".",
+            "packages/server",
+            "packages/client",
+            "packages/web",
+            "apps/server",
+            "apps/api",
+            "apps/web",
+            "apps/client",
+            "server",
+            "client",
+            "web",
+        ]) {
+            const abs = resolve(projectDir, dir);
+            chunks.push(readIfExists(join(abs, ".env.production")));
+            chunks.push(readIfExists(join(abs, ".env.development")));
+        }
+    }
+    if (baseName) {
+        const provisionedDir = join(dirname(getConfigPath()), "provisioned");
+        if (existsSync(provisionedDir)) {
+            for (const file of readdirSync(provisionedDir)) {
+                if (file.startsWith(`${baseName}.`) && file.endsWith(".env")) {
+                    chunks.push(readIfExists(join(provisionedDir, file)));
+                }
+            }
+        }
+    }
+    return chunks.join("\n");
+}
+function servicesAlreadyAdded(args) {
+    const text = readProjectEnvText(args.projectDir, args.baseName);
+    const added = new Set();
+    if (/(^|\n)(PUBLIC_)?GLITCHTIP_DSN=/m.test(text))
+        added.add("glitchtip");
+    if (/(^|\n)(PUBLIC_)?OPENPANEL_CLIENT_ID=/m.test(text))
+        added.add("openpanel");
+    if (/(^|\n)(NEXT_PUBLIC_|PUBLIC_)?PLAUSIBLE_DOMAIN=/m.test(text))
+        added.add("plausible");
+    if (/(^|\n)RESEND_API_KEY=/m.test(text))
+        added.add("resend");
+    if (/(^|\n)R2(_[A-Z0-9]+)?_ACCESS_KEY_ID=/m.test(text))
+        added.add("s3");
+    if (manifestBucketEntries(args.manifest).some((bucket) => bucket.tokenId))
+        added.add("s3");
+    if (args.manifest?.integrations?.email)
+        added.add("email");
+    if (args.manifest?.integrations?.searchConsole)
+        added.add("search-console");
+    return added;
+}
+function servicesImpossibleForProject(manifest) {
+    const blocked = new Set();
+    if (!manifest)
+        return blocked;
+    if (!manifest.domain) {
+        blocked.add("email");
+        blocked.add("search-console");
+    }
+    if (manifest.surfaces === "server-only")
+        blocked.add("plausible");
+    if (manifest.surfaces === "client-only") {
+        blocked.add("resend");
+        blocked.add("s3");
+    }
+    if (manifestBucketEntries(manifest).length === 0)
+        blocked.add("s3");
+    return blocked;
+}
+function recordProvisionedEvent(ledger, event) {
+    if (event.service === "glitchtip")
+        ledger.record({ kind: "glitchtip", project: event.project });
+    if (event.service === "openpanel")
+        ledger.record({ kind: "openpanel", project: event.project });
+    if (event.service === "plausible" && event.created) {
+        ledger.record({ kind: "plausible", project: event.project });
+    }
+    if (event.service === "resend")
+        ledger.record({ kind: "resend", client: event.client });
+    if (event.service === "s3" && event.minted) {
+        ledger.record({
+            kind: "r2Token",
+            tokenId: event.tokenId,
+            accountId: event.accountId,
+            audience: "account",
+        });
+    }
+    if (event.service === "search-console" && event.dnsRecord?.created) {
+        ledger.record({
+            kind: "cloudflareDnsRecord",
+            zoneId: event.dnsRecord.zoneId,
+            recordId: event.dnsRecord.id,
+            name: event.dnsRecord.name,
+            type: event.dnsRecord.type,
+        });
+    }
+    if (event.service === "email") {
+        if (event.destinationCreatedThisRun) {
+            ledger.record({
+                kind: "cloudflareEmailDestination",
+                accountId: event.accountId,
+                destinationId: event.destinationId,
+                email: event.destinationEmail,
+            });
+        }
+        for (const dns of event.dnsRecords) {
+            ledger.record({
+                kind: "cloudflareDnsRecord",
+                zoneId: event.zoneId,
+                recordId: dns.id,
+                name: dns.name,
+                type: dns.type,
+            });
+        }
+        for (const rule of event.rules) {
+            if (!rule.created)
+                continue;
+            ledger.record({
+                kind: "cloudflareEmailRoutingRule",
+                zoneId: event.zoneId,
+                ruleId: rule.id,
+                address: rule.address,
+            });
+        }
+    }
+}
 async function handleAdd() {
     // Positional args are optional — anything missing is prompted for.
     //   hatchkit add                             (fully interactive)
     //   hatchkit add raptor-runner               (prompts for services)
     //   hatchkit add raptor-runner all
     //   hatchkit add raptor-runner glitchtip,resend
-    const positional = args.slice(1).filter((a) => !a.startsWith("--"));
-    let baseName = positional[0];
-    const rawService = positional[1];
     const allServices = [
         "glitchtip",
         "openpanel",
@@ -470,6 +621,24 @@ async function handleAdd() {
         "email",
         "search-console",
     ];
+    const isServiceExpr = (value) => {
+        if (!value)
+            return false;
+        if (value === "all")
+            return true;
+        return value
+            .split(",")
+            .map((s) => s.trim().toLowerCase())
+            .every((s) => allServices.includes(s));
+    };
+    const positional = args.slice(1).filter((a) => !a.startsWith("--"));
+    const inferredProjectDir = inferProjectDir(process.cwd());
+    const inferredManifest = inferredProjectDir ? readManifest(inferredProjectDir) : null;
+    const firstArgIsService = isServiceExpr(positional[0]);
+    let baseName = firstArgIsService
+        ? inferredManifest?.name
+        : (positional[0] ?? inferredManifest?.name);
+    const rawService = firstArgIsService ? positional[0] : positional[1];
     if (!baseName) {
         const { input } = await import("@inquirer/prompts");
         const { validateProjectName } = await import("./utils/validate.js");
@@ -478,37 +647,54 @@ async function handleAdd() {
             validate: validateProjectName,
         });
     }
+    const alreadyAdded = servicesAlreadyAdded({
+        baseName,
+        projectDir: inferredProjectDir,
+        manifest: inferredManifest,
+    });
+    const impossible = servicesImpossibleForProject(inferredManifest);
+    const hiddenServices = new Set([...alreadyAdded, ...impossible]);
+    const addableServices = allServices.filter((service) => !hiddenServices.has(service));
     let services;
     if (!rawService) {
+        if (addableServices.length === 0) {
+            console.log(chalk.green(`  Nothing to add — ${baseName} already has every supported service.`));
+            return;
+        }
         const { multiselect } = await import("./utils/multiselect.js");
+        const serviceChoices = [
+            { name: "GlitchTip (error tracking)", value: "glitchtip", checked: false },
+            { name: "OpenPanel (product analytics)", value: "openpanel", checked: false },
+            { name: "Plausible (web analytics)", value: "plausible", checked: false },
+            { name: "Resend (transactional email)", value: "resend", checked: false },
+            {
+                name: "S3 / R2 (per-bucket scoped credentials from .hatchkit.json)",
+                value: "s3",
+                checked: false,
+            },
+            {
+                name: "Email forwarding (Cloudflare Email Routing — MX/SPF/DMARC + rules)",
+                value: "email",
+                checked: false,
+            },
+            {
+                name: "Google Search Console (DNS verification + domain property)",
+                value: "search-console",
+                checked: false,
+            },
+        ];
         services = await multiselect({
             message: "Which services to add?",
-            choices: [
-                { name: "GlitchTip (error tracking)", value: "glitchtip", checked: true },
-                { name: "OpenPanel (product analytics)", value: "openpanel", checked: true },
-                { name: "Plausible (web analytics)", value: "plausible", checked: false },
-                { name: "Resend (transactional email)", value: "resend", checked: true },
-                {
-                    name: "S3 / R2 (per-bucket scoped credentials from .hatchkit.json)",
-                    value: "s3",
-                    checked: false,
-                },
-                {
-                    name: "Email forwarding (Cloudflare Email Routing — MX/SPF/DMARC + rules)",
-                    value: "email",
-                    checked: false,
-                },
-                {
-                    name: "Google Search Console (DNS verification + domain property)",
-                    value: "search-console",
-                    checked: false,
-                },
-            ],
+            choices: serviceChoices.filter((choice) => addableServices.includes(choice.value)),
             required: true,
         });
     }
     else if (rawService === "all") {
-        services = allServices;
+        services = addableServices;
+        if (services.length === 0) {
+            console.log(chalk.green(`  Nothing to add — ${baseName} already has every supported service.`));
+            return;
+        }
     }
     else {
         const requested = rawService.split(",").map((s) => s.trim().toLowerCase());
@@ -518,7 +704,17 @@ async function handleAdd() {
             console.log(chalk.dim(`  Valid: ${allServices.join(", ")}, or 'all'`));
             process.exit(1);
         }
-        services = requested;
+        const skipped = requested.filter((service) => hiddenServices.has(service));
+        if (skipped.length > 0) {
+            console.log(chalk.red(`  Refusing to add already-present/unavailable service(s): ${skipped.join(", ")}`));
+            console.log(chalk.dim("  Run `hatchkit remove` first if you want Hatchkit to recreate them."));
+            process.exit(1);
+        }
+        services = requested.filter((service) => !hiddenServices.has(service));
+        if (services.length === 0) {
+            console.log(chalk.green(`  Nothing to add — requested service(s) are already present or unavailable.`));
+            return;
+        }
     }
     // Flag parsing:
     //   --no-write                      → never write; print a cache summary only
@@ -573,7 +769,16 @@ async function handleAdd() {
                 : inferProjectDir(needsServer ? resolvePath(serverDirFlag) : undefined),
         };
     }
-    await runProvision({ baseName, services, surfaces, enableDevObs });
+    const ledger = RunLedger.resumeOrStart(baseName);
+    await runProvision({
+        baseName,
+        services,
+        surfaces,
+        enableDevObs,
+        failIfExists: true,
+        onProvisioned: (event) => recordProvisionedEvent(ledger, event),
+    });
+    ledger.complete();
 }
 async function handleProvisionS3() {
     // `hatchkit provision s3` — create the public+private bucket pair
@@ -970,6 +1175,13 @@ async function handleCreate() {
         config.installDeps = false;
     if (forceNoLocalDev)
         config.localDev = undefined;
+    // Terraform's Cloudflare stacks can only write records into an
+    // existing zone. Check that before project-specific mutations such as
+    // scaffolding, provider clients, GitHub repos, or infra files.
+    if (config.deploymentMode === "coolify" && config.runDeployment && !config.dryRun) {
+        const dns = await ensureDns();
+        await requireCloudflareZoneForTerraform(config.baseDomain, dns);
+    }
     // Ensure needed providers are configured (lazy prompting).
     // Coolify + Hetzner only matter for the coolify deployment mode.
     // gh-pages skips them entirely (no server, no Docker registry).
@@ -1114,7 +1326,7 @@ async function handleCreate() {
                                 else if (event.service === "openpanel") {
                                     ledger?.record({ kind: "openpanel", project: event.project });
                                 }
-                                else if (event.service === "plausible") {
+                                else if (event.service === "plausible" && event.created) {
                                     ledger?.record({ kind: "plausible", project: event.project });
                                 }
                             },
@@ -2021,9 +2233,13 @@ function printHelp(topic) {
                                without the fragment).
 
   ${chalk.bold("DNS:")}
-    ${chalk.cyan("dev-setup init")} auto-upserts a DNS-only A record:
+    ${chalk.cyan("dev-setup init")} auto-upserts a DNS-only A record on a
+    dedicated ${chalk.cyan("local.")} subdomain:
     *.local.<your-domain>  A  <your-tailnet-ip>  (DNS-only)
 
+    Custom ${chalk.cyan("--domain")} values must use that ${chalk.cyan("local.")} prefix so
+    Hatchkit never overwrites a production wildcard such as *.example.com.
+
     If Cloudflare credentials are unavailable, add that record manually.
 
   This feature is fully optional: until you run ${chalk.cyan("dev-setup init")},
@@ -2138,6 +2354,7 @@ function printHelp(topic) {
 
   ${chalk.bold("Usage:")}
     hatchkit add [<project-name>] [<services>] [flags]
+    hatchkit add [<services>] [flags]   ${chalk.dim("(inside a project with .hatchkit.json)")}
 
   ${chalk.bold("What it does:")}
     · GlitchTip / OpenPanel: ${chalk.bold("one project per product")}, events tagged by
@@ -2155,6 +2372,11 @@ function printHelp(topic) {
     · A 0600 cache of every value is saved under
       ${chalk.dim("<config-dir>/provisioned/<project>.*.env")} for recoverability.
       ${chalk.dim("Secret values never hit stdout.")}
+    · The interactive menu only shows services not already present for the
+      current project, starts with nothing selected, and refuses explicit
+      requests that would recreate known resources.
+    · Before creating provider resources, add runs read-only existence probes
+      for the selected services and stops on conflicts so cleanup stays safe.
 
   ${chalk.bold("Surfaces:")}
     hatchkit asks which surfaces your project has. Options:
@@ -2190,6 +2412,7 @@ function printHelp(topic) {
 
   ${chalk.bold("Examples:")}
     hatchkit add
+    hatchkit add search-console
     hatchkit add raptor-runner
     hatchkit add raptor-runner all --enable-dev-obs
     hatchkit add raptor-runner glitchtip,resend --no-write
@@ -2513,13 +2736,13 @@ function printHelp(topic) {
     }
     if (topic === "assets") {
         console.log(`
-  ${chalk.bold("hatchkit assets")} — move bytes between local MinIO and prod buckets
+  ${chalk.bold("hatchkit assets")} — move bytes between local S3 and prod buckets
 
   ${chalk.bold("Subcommands:")}
-    assets seed     [--from <dir>]                Local dir → local MinIO bucket.
+    assets seed     [--from <dir>]                Local dir → local S3 bucket.
                                                   Defaults to ./seed/assets.
-    assets push     [--bucket assets|state]       Local MinIO → prod bucket.
-    assets pull     [--bucket assets|state]       Prod bucket → local MinIO.
+    assets push     [--bucket assets|state]       Local S3 → prod bucket.
+    assets pull     [--bucket assets|state]       Prod bucket → local S3.
                                                   Caution: prod data may include PII.
     assets migrate  --from-endpoint=URL           External S3 → prod bucket.
                     --from-bucket=NAME            The adoption escape hatch — copy
@@ -2546,7 +2769,7 @@ function printHelp(topic) {
     the env doesn't carry them (R2's URL-driven assets bucket).
 
   ${chalk.bold("Examples:")}
-    hatchkit assets seed                                # ./seed/assets/ → local MinIO
+    hatchkit assets seed                                # ./seed/assets/ → local S3
     hatchkit assets push --dry-run                      # see what would ship to prod
     hatchkit assets push                                # actually ship it
     hatchkit assets migrate --from-endpoint https://nyc3.digitaloceanspaces.com \\
@@ -2587,7 +2810,7 @@ function printHelp(topic) {
     update          Add features to an already-scaffolded project (run in project dir)
     server add      Retrofit a server into a client-only project
     add             Create GlitchTip / OpenPanel / Plausible / Resend clients for an existing project
-    assets          Move bytes between local MinIO and prod buckets (seed/push/pull/migrate)
+    assets          Move bytes between local S3 and prod buckets (seed/push/pull/migrate)
     remove          Delete the -dev/-prod clients created by 'add' (inverse of add)
     destroy         Roll back everything ${chalk.cyan("hatchkit create")} did for a project
     rename-domain   Move a scaffolded project to a new domain (rewrites tfvars/env/manifest)